View source for Postfix: SMTP Authentication for Clients with DOVECOT (en)

==Prepare Dovecot==

Edit to prepare Dovecot as an auth server for Postfix:

 vim /etc/dovecot/conf.d/10-master.conf

Ensure:

 service auth {
    ...
    unix_listener /var/spool/postfix/private/auth {
        mode = 0660
        user = postfix
        group = postfix
    } ##end listener
    ...
 }

Edit:

 vim /etc/dovecot/conf.d/10-auth.conf

Ensure:

 auth_mechanisms = plain login


Edit:

 vim /etc/dovecot/conf.d/10-ssl.conf

Ensure:

 ssl = yes

==Edit Postfix==

Edit:

 vim /etc/postfix/main.cf

Ensure:

 # TLS parameters
 smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
 smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
 smtpd_use_tls=yes
 smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
  
 smtpd_tls_auth_only = no
 smtpd_tls_loglevel = 1
 smtpd_recipient_restrictions = 
 permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
 smtp_tls_security_level = may
 smtpd_tls_security_level = may
 smtp_tls_note_starttls_offer = yes
 smtpd_tls_loglevel = 1
 smtpd_tls_received_header = yes
  
 smtpd_sasl_type = dovecot
 smtpd_sasl_path = private/auth
 smtpd_sasl_local_domain =
 smtpd_sasl_security_options = noanonymous
 broken_sasl_auth_clients = yes
 smtpd_sasl_auth_enable = yes
  
 smtpd_relay_restrictions = permit_mynetworks,
          permit_sasl_authenticated,
          reject_unauth_destination

Edit:

 vim /etc/postfix/master.cf

Ensure:

 submission inet n       -       -       -       -       smtpd
   -o syslog_name=postfix/submission
   -o smtpd_tls_security_level=encrypt
   -o smtpd_sasl_auth_enable=yes
   -o smtpd_reject_unlisted_recipient=no
 #  -o smtpd_client_restrictions=$mua_client_restrictions
 #  -o smtpd_helo_restrictions=$mua_helo_restrictions
 #  -o smtpd_sender_restrictions=$mua_sender_restrictions
 #  -o smtpd_recipient_restrictions=
   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
   -o milter_macro_daemon_name=ORIGINATING
 smtps     inet  n       -       -       -       -       smtpd
   -o syslog_name=postfix/smtps
   -o smtpd_tls_wrappermode=yes
   -o smtpd_sasl_auth_enable=yes
   -o smtpd_reject_unlisted_recipient=no
 #  -o smtpd_client_restrictions=$mua_client_restrictions
 #  -o smtpd_helo_restrictions=$mua_helo_restrictions
 #  -o smtpd_sender_restrictions=$mua_sender_restrictions
 #  -o smtpd_recipient_restrictions=
   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
   -o milter_macro_daemon_name=ORIGINATING

==Ensure all mail functions==

Telnet, type:

 telnet localhost 25
 ehlo test

Output:

 250-onnocenter.or.id
 250-PIPELINING
 250-SIZE 10240000
 250-VRFY
 250-ETRN
 '''250-STARTTLS'''
 '''250-AUTH PLAIN LOGIN'''
 '''250-AUTH=PLAIN LOGIN'''
 250-ENHANCEDSTATUSCODES
 250-8BITMIME
 250 DSN

Ensure presence of:

* STARTTLS
* AUTH

Type:

 netstat -nl4

Output:

 Active Internet connections (only servers)
 Proto Recv-Q Send-Q Local Address           Foreign Address         State      
 tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN     
 tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN     
 tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN     
 tcp        0      0 0.0.0.0:995             0.0.0.0:*               LISTEN     
 tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN     
 tcp        0      0 0.0.0.0:110             0.0.0.0:*               LISTEN     
 tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN     
 tcp        0      0 0.0.0.0:465             0.0.0.0:*               LISTEN

For easy setup on Android clients, ensure your machine has hostname:

 smtp.yourdomain
 pop3.yourdomain
 imap.yourdomain

==Setup in Mail Android==

Set SMTP:

* login required
* START/TLS
* port 465

==References==

* http://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL